QUEUED FINDINGS -- session 2026-08-07 "dc1-region sequence" (F + Stage-5 dc1 standup B/C + SEC-031 edge rebuild)
Method: read the whole session, grep each candidate. FIRST SURFACE = existed only in the transcript.
Body: docs/changelog-20260807-dc1-region-sequence.md. Status ONLY in docs/CURRENT-STATE.md.

================================================================================
FIRST SURFACE (existed only in the transcript -- would have been lost on /clear)
================================================================================

F1. scripts/opnsense-console-rebuild.py SHIPPED WITHOUT A HARNESS.
    Committed in 2b476e4. The change-delivery loop says no script ships without its
    tests/<name>/run-tests.sh. It is a pexpect serial-console driver (hard to test fully
    offline), but a MINIMAL harness is feasible and owed: parse check, --help exit 0,
    structure asserts (no hardcoded domain/pubkey; PHP payload carries require_once util.inc
    + local_user_set + write_config; base64 <=160-char chunking present; PUB read from file).
    Prove-it-can-fail per the 2026-07-30 mutation lesson. OWED next session.

F2. run-logged.sh NOT opened this session -- as-executed log GAP for a heavy-mutation window.
    This session executed many live mutations (dc1 topology apply, IPAM carve/reserve, the
    DHCP cutover, power-key install, the full edge REBUILD incl. tofu destroy+recreate) with
    NO as-executed log. 4th+ consecutive session with this gap (O3 in prior sweeps). The
    changelog + captures are the record; declare the log gap on a surface (this file).

F3. MAAS image-sync TRAP: jammy is NOT selectable until the region's boot-source INDEX is
    refreshed. On a fresh region, `boot-source-selections create ... release=jammy` returns
    "OS ubuntu with release jammy has no available images for download" until a first
    `boot-resources import` fetches the simplestreams index from images.maas.io. Sequence:
    import (fetches index) -> add jammy selection -> import again (downloads jammy). Measured
    2026-08-07 on vr1-dc1-region. Worth a line in the dc1 region-standup NEXT / a runbook.

================================================================================
ALREADY ON SURFACE (recorded where noted)
================================================================================

S1. NetBox tool GAP closed: no importer recorded D-134 utility-HOST IPs (only band ranges +
    VIPs). Built netbox/dc-util-hosts-import.py + harness 19/19. -> changelog Item 1, CURRENT-STATE.

S2. office1-netbox dcim/regions are GEOGRAPHIC (US-West/VR0/VR1), not MAAS regions -- so
    vr1-dc1-region needs no NetBox object (the .6 IP represents it). -> changelog Item 1, CURRENT-STATE.

S3. NetBox findings DEFERRED for operator: (a) the .4 ARTIFACT host (dc0 mirror / dc1 cache,
    metal-admin-only 10.12.8.4 / 10.12.68.4, per-DC divergent, NO repo name) needs a NAMING
    ruling before it can be recorded; (b) dc1 .5 juju + .7 tailscale record WHEN LIVE.
    -> changelog Item 1, CURRENT-STATE.

S4. DHCP cutover FALSE ALARM: a bare `pgrep -c dhcpd` self-matched its own command shell and
    read 1, looking like dual-serve. `ss :67` / `pgrep -af` are authoritative. No dual-serve.
    -> changelog Item 2.

S5. MEASURED-CORRECTS-MEMORY: the dc1 metal-admin DYNAMIC DHCP range is 10.12.68.201-.254,
    NOT the .100-.200 recalled from G12 prose. -> changelog Item 2.

S6. dc-plane-ipam reserve reported skipped=6 on v6 bands though carve-v6 had landed; the
    read-only check 24/0 confirms the ruled state is fully present. GLANCE owed. -> changelog Item 2.

S7. SEC-031 CLOSED: dc1 edge rebuilt (proven dc0 procedure), egress restored, dc-egress-check
    dc1 8/8. Procedure now runbooks/dc-edge-rebuild.md + scripts/opnsense-console-rebuild.py.
    -> changelog Item 4, CURRENT-STATE, security-ledger SEC-031.

S8. dc-egress-check A2 is STRUCTURALLY BLIND to "edge answers but does not NAT" (pre-existing
    finding, CURRENT-STATE ~4013). Still open as a gate-improvement candidate (positive
    "edge TRANSLATES" assertion). NOT actioned. -> CURRENT-STATE.

================================================================================
OPERATOR RULINGS THIS SESSION (OPS-level directives; exact utterances)
================================================================================
- "Sequence and continue"; "Land the Netbox then move on to the rest of the sequence"
- NetBox gap: "Build importer, then land"
- DHCP: "Full cutover first. It shouldn't have had DHCP from Office1 to begin with."
- Image egress: "Fix .6 own egress to match dc0"
- Step B: "I approve you running these commands"
- Edge: "I drive the SEC-031 edge repair now"; "look back at the steps that were successful with dc0"
- Documentation: "make sure the steps and procedures are logged accurately so when we do this
  again we won't go down this path again when there is a proven method and tools documented"
  -> actioned: runbooks/dc-edge-rebuild.md + scripts/opnsense-console-rebuild.py + SEC-031 close.
(None is a GA-R5 D-number ruling; all are OPS directives -> changelog/runbook, no D-number.)

================================================================================
DELIBERATELY NOT DONE (deferred, with reason)
================================================================================
- D (import SSH keys into vr1-dc1-region), E (rebuild 9 nodes + juju + .7 -- destructive,
  batches of 3, incl SEC-028 in-region juju mint + SEC-026 residency), G (consolidate dc1 .6
  creds SEC-020) -- deferred to next session (session length).
- jammy image sync: TRIGGERED + downloading at close; verify .complete=true next session.
- The 2 NetBox findings (S3) + the console-driver harness (F1).